Extracted

• • Target

    PackageTracking.js

  • Size

    2.2MB

  • MD5

    4331a93b3bb41b1dbee33654a356e185

  • SHA1

    5a69f4e88f9ab7e6d7278ae16860c634593bfaa8

  • SHA256

    af6ece1e6be8d5511a407806c24ca95fbf9e69e6ec595830342dc748868a0d0d

  • SHA512

    2e5c3b9a29e39c167336824244868b953908bda5b7e94a02ab0549785d966792d60bed310f4df547c97c1dbccd4742f6ca570f8638c46495955d91176a64338e

  • SSDEEP

    12288:mJvm6+EhCkN1tbZvbssZ+nMXGiK5qqQvUknS+jN55EnMQ7Q0lq8JgEFJPwMhy+lQ:iR5j1DvRXG9Jy8CUPfpg59QIMrJFA

  Score

  10^/10

  wshratpersistencetrojan

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

    trojanwshrat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence
  behavioral1behavioral2